Laravel The Select Lookup database operation

$data2 = DB::select('select * from produce where stype_id = ".$id."');

The page came with a category ID

Search for all products under this category ID

And this category ID is a set of string forms

So look at the question, how did the great God write the query statement?

Reply content:

$data2 = DB::select('select * from produce where stype_id = ".$id."');

The page came with a category ID

Search for all products under this category ID

And this category ID is a set of string forms

So look at the question, how did the great God write the query statement?

php$data2 = DB::select('select * from produce where stype_id in( ".$id."'));//用Eloquent ORMproduce::whereIn('stype_id',[$id]);

will be injected by SQL, such as $id = "1;drop table xxx;"
The simplest way to avoid injecting is to use an ORM to provide a method that does not directly write SQL statements

No eloquent ORM?

